Hostname Verification Bypass in Apache HttpComponents HttpClient and HttpAsyncClient
Summary
CVE-2014-3577: org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common... Affects commons-httpclient versions < 3.1-11. Fixed in 3.1-11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpComponents HttpClient and HttpAsyncClient are widely used libraries in Java for making HTTP requests. They provide a robust framework for handling HTTP connections, including support for SSL/TLS. However, prior to certain versions, these libraries had a critical flaw in hostname verification, which could lead to security vulnerabilities when connecting to SSL servers.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3577, arises from the failure of org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient (versions before 4.3.5) and HttpAsyncClient (versions before 4.0.2) to properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers, potentially leading to unauthorized access to sensitive data. An example of this vulnerability is demonstrated by the string 'foo,CN=www.apache.org' in the distinguished name (DN) of a certificate, which could mislead the verification process.
How To Fix
Minimum fixed version
3.1-11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade commons-httpclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a custom hostname verifier that enforces strict hostname verification. This can be done by creating a class that implements the HostnameVerifier interface and overriding the verify method to include your own hostname checks. Here is a sample code snippet:
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
public class CustomHostnameVerifier implements HostnameVerifier { @Override public boolean verify(String hostname, SSLSession session) {
// Implement your hostname verification logic here
return hostname.equals("expected.hostname.com");
}
}
HttpsURLConnection.setDefaultHostnameVerifier(new CustomHostnameVerifier());
Conclusion
CVE-2014-3577 represents a significant security risk for applications using affected versions of Apache HttpComponents HttpClient and HttpAsyncClient. It is crucial for developers to upgrade to the latest versions to ensure proper hostname verification and protect against potential man-in-the-middle attacks. Additionally, implementing a custom hostname verifier can serve as a temporary mitigation strategy.
See every vulnerability recorded for commons-httpclient →
FAQ
CVE-2014-3577 is a vulnerability in Apache HttpComponents HttpClient and HttpAsyncClient that allows man-in-the-middle attacks due to improper hostname verification.
The vulnerability affects Apache HttpComponents HttpClient versions before 4.3.5 and HttpAsyncClient versions before 4.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can allow attackers to intercept and manipulate sensitive data transmitted over SSL connections, leading to data breaches or unauthorized access.
Yes, you can implement a custom hostname verifier to enforce stricter hostname checks until you can upgrade to the patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for commons-httpclient.
